Towards Comprehensive Analysis of Tor Hidden Service Access Behavior Identification under Obfs4 Scenario

Abstract

In this paper, we present a novel approach to identify Tor hidden service access activity with key sequences under Obfs4 scenario. By calculating the key cell signals occurred during Tor hidden service access process, we get the start index and window size of the key TCP package sequence of traffic. In order to verify the effectiveness of this method, we perform comprehensive analysis under nine scenarios of different Obfs4 transmission model. We find through experimental results that there is a TCP package sequence window, which has a great contribution to identifying Tor hidden service access traffic. Only use the key TCP sequence as input, we can achieve more than 90% accuracy as well as recall in nine scenarios.